Snort problem

simonchs

@simonchs:

i've just reinstalled twice the snort package, but i can't start-up the snort service, here are the log:

May 26 18:35:47 xxxxx snort[23564]: Initializing daemon mode
May 26 18:35:47 xxxxx snort[23564]: Initializing daemon mode
May 26 18:35:47 xxxxx snort[23567]: PID path stat checked out ok, PID path set to /var/run/
May 26 18:35:47 xxxxx snort[23567]: PID path stat checked out ok, PID path set to /var/run/
May 26 18:35:47 xxxxx snort[23567]: FATAL ERROR: Failed to Lock PID File "/var/run//snort_em1.pid" for PID "23567"
May 26 18:35:47 xxxxx snort[23567]: FATAL ERROR: Failed to Lock PID File "/var/run//snort_em1.pid" for PID "23567"
May 26 18:35:48 xxxxx snort[23564]: Child exited unexpectedly
May 26 18:35:48 xxxxx snort[23564]: Child exited unexpectedly
May 26 18:35:48 xxxxx snort[23564]: Daemon parent exiting
May 26 18:35:48 xxxxx snort[23564]: Daemon parent exiting
May 26 18:35:56 xxxxx snort2c[23647]: snort2c running in daemon mode pid: 23647
May 26 18:35:56 xxxxx snort2c[23647]: snort2c running in daemon mode pid: 23647
May 26 18:36:13 xxxxx SnortStartup[23667]: Ram free BEFORE starting Snort: 59M – Ram free AFTER starting Snort: 59M -- Mode ac-bnfa -- Snort memory usage:

i've tried to stop the snort service, remove the file /var/run/snort_em1.pid.lck and start the snort service again, and even reboot my pfsense, but got the same log as above.

any trick?

If any of you are still having problems. Please fallow these steps.

1. Reinstall snort. (So that the new code gets updated.)

2. Deinstall snort. (New code deinstalls all the old snort packages.)

3. Install the snort package.

4. Update the rules.

Finished, snort should work now.

James

thanks James, still no luck, same log shown as above post. the "snort" can't start while the "snort2c" can run.

simonchs

i've just modified /usr/local/etc/rc.d/snort.sh and changed:
snort -c /usr/local/etc/snort/snort.conf -l /var/log/snort -D -i em1 -A fast -q
to:
snort -c /usr/local/etc/snort/snort.conf -l /var/log/snort -i em1 -A fast -q &
then the snort work properly

is there any way to trace the problem?

thanks.

firbc

I have similar problem:

snort[1317]: FATAL ERROR: Failed to Lock PID File "/var/run//snort_xl0.pid" for PID "1317"
snort[1317]: FATAL ERROR: Failed to Lock PID File "/var/run//snort_xl0.pid" for PID "1317"

Also snort do not work after reboot. It starts, it is also loaded to memory but not working. I have to clean alert logs and after that snort restart itself and then start to work.

jamesdean

Hey firbc, simonchs..

Can you guys tell me what version of pfsense your running. I have a feeling its 1.2 and not 1.2.3.

Also, please tell me whats the output of "pkg_info".

Help me help you.
james

simonchs

running pfsense 1.2.2

and the output of pkg_info:

arc-5.21o_1 Create & extract files from DOS .ARC files
arj-3.10.22_1 Open-source ARJ
bandwidthd-2.0.1_1 Tracks bandwidth usage by IP address
clamav-0.93.1_2 Command line virus scanner written entirely in C
gd-2.0.35,1 A graphics library for fast creation of images
havp-0.88 HTTP Antivirus Proxy
jpeg-6b_4 IJG's jpeg compression utilities
lha-1.14i_6 Archive files using LZSS and Huffman compression (.lzh file
libdnet-1.11_3 A simple interface to low level networking routines
libgmp-4.2.2 A free library for arbitrary precision arithmetic
libiconv-1.11_1 A character set conversion library
lightsquid-1.7.1_1 A light and fast web based squid proxy traffic analyser
mysql-client-5.1.34 Multithreaded SQL database (client)
openldap-client-2.4.10 Open source LDAP client implementation
openldap-client-2.4.11 Open source LDAP client implementation
p5-GD-2.39 A perl5 interface to Gd Graphics Library version2
pcre-7.9 Perl Compatible Regular Expressions library
perl-5.8.8_1 Practical Extraction and Report Language
snort-2.8.4.1 Lightweight network intrusion detection system
squid-2.6.21 HTTP Caching Proxy
squid_radius_auth-1.10 RADIUS authenticator for squid proxy 2.5 and later
unzoo-4.4_2 A zoo archive extractor

jamesdean

Simochs

Your setup looks fine.

Have you tryed this.
Type this in the terminal "rm -r /var/run/snort*"

Restart snort.

If snort still fails type this in so that I can have a better output of the error.

"snort -c /usr/local/etc/snort/snort.conf -l /var/log/snort -v -i ng0 -A fast"

Help me help you
James

simonchs

yes, i've tried "rm -r /var/run/snort*" and restart snort, still failed.

when i type "snort -c /usr/local/etc/snort/snort.conf -l /var/log/snort -v -i ng0 -A fast", snort keep running and do not have error. as my previous modify to /usr/local/etc/rc.d/snort.sh, i can run snort without -D parameter.

so i guess the snort binary cannot "daemonize" itself?

jamesdean

That is a realy wierd error ? I have never seen a error in snort were -D is the cause.

What version of 1.2.2 do you have scmochs ?

Right now Im runing 1.2.3. So im going to have to install 1.2 and retest snort.
Then im going to install all your packages and try to reproduce your error.

If there are no errors when I install pfsense 1.2 with the new snort package then you need a fresh install, mabe pfsense 1.2.3.

Get some sleep, I will figure this out.

help me help you
rob

simonchs

i'm running pfsense version 1.2.2

thanks James

jamesdean

@simonchs:

i'm running pfsense version 1.2.2

thanks James

Theres usually a date like mine says

1.2.3-RC1
built on Wed Apr 22 15:36:34 EDT 2009

firbc

@jamesdean:

Hey firbc, simonchs..

Can you guys tell me what version of pfsense your running. I have a feeling its 1.2 and not 1.2.3.

Also, please tell me whats the output of "pkg_info".

Help me help you.
james

I am running version 1.2.3-RC1, built on Fri May 22 16:32:57 EDT 2009 of pfSense.

bandwidthd-2.0.1_1 Tracks bandwidth usage by IP address
gd-2.0.35,1 A graphics library for fast creation of images
grub-0.97_1 GRand Unified Bootloader
jpeg-6b_4 IJG's jpeg compression utilities
libdnet-1.11_3 A simple interface to low level networking routines
libiconv-1.11_1 A character set conversion library
libosip-3.1.0 A low layer of SIP implementation
mysql-client-5.0.77_1 Multithreaded SQL database (client)
mysql-client-5.1.34 Multithreaded SQL database (client)
packages BSD Installer mega-package
pcre-7.8 Perl Compatible Regular Expressions library
pcre-7.9 Perl Compatible Regular Expressions library
siproxd-0.7.0_1 A proxy/masquerading daemon for the SIP protocol
snort-2.8.4.1 Lightweight network intrusion detection system

Any idea? Thx

jamesdean

Fixed the problem waiting for new snort packages to be built.

Please be pationant.

Snort will be working on pfsense 1.2.2 soon.

james

Welp i'm having similar problem with snort too. I reinstalled a fresh copy of pfsense 1.2.2 because i mess it up and when it was running i had snort running beautifully until i reinstall snort after i did a fresh install of pfsense. Before i install Snort i looked at the platform and it was for 1.2.3 but i was hoping it would work for 1.2.2 but i guess not. Will the fix be up soon? I would also like to suggest or request something from the pfsense team to put up multiple applicatoin for different platform so we won't get confuse.
For example: Snort 1.2.2
Snort 1.2.3
Instead of a just single update. Anyhow, you guys are doing a great job and we all appreciated. Please let us know when the fix is up. Thanks for everything. Look foward to the fix.

lordarcane

I´ll guess that my problem is related to the fact that I updated snort and now i´m unable to update the rules. Getting md5 signature mismatch and snort refuses to start.

jamesdean

@lordarcane:

I´ll guess that my problem is related to the fact that I updated snort and now i´m unable to update the rules. Getting md5 signature mismatch and snort refuses to start.

Thanx for the heads up. Snort.org changed there md5 format to day to go along with there nice new website.

From this > c2844479ed68cc0f13ab61f69e35bc7a

To this >MD5 (snortrules-snapshot-2.8.tar.gz) = c2844479ed68cc0f13ab61f69e35bc7a

Going have to code a fix.
Man Snort Package is killing me this week.
If they change it back after I code a fix, Im going on a vacation ASAP.

james

mentalhemroids

My thanks to JamesDean and anyone else working on this problem. I know others appreciate the hard work done with this and all other packages. It's not a easy task keeping up with technology, or life for that matter.

Thanks!

So has there been a fix?

serialdie

Waiting for the MD5 fix as well :)

TIA!

Can anyone tell me if this is normal?

May 31 12:56:05 snort[12638]: Warning: flowbits key 'PtakkS_Keepalive' is set but not ever checked. 
May 31 12:56:05 snort[12638]: Warning: flowbits key 'dce.bind.wkssvc' is set but not ever checked. 
May 31 12:56:05 snort[12638]: Warning: flowbits key 'dce.bind.wkssvc' is set but not ever checked. 
May 31 12:56:05 snort[12638]: Warning: flowbits key 'snipernet' is set but not ever checked. 
May 31 12:56:05 snort[12638]: Warning: flowbits key 'snipernet' is set but not ever checked. 
May 31 12:56:05 snort[12638]: 316 out of 512 flowbits in use. 
May 31 12:56:05 snort[12638]: 316 out of 512 flowbits in use.

Thank you.

jamesdean

I updated the the snort package today to fix the md5 error and snort.org's new oink code verification urls for rule updates.

Snort should work but there might be errors when snort.org goes down.
I still need to add code for primium snort.org oink users and clean up the code.
Have patience.

I need people to install the snort package post here. Post failers and success here. Please post your pfsense version and system specs.
Remember to update the rules befor starting snort after reinstall.

If anyone cares this is what happened this month with the snort package.

1. Snort.org changed there code codebase for rpc, result broke the pfsense snort packge.

2. I fixed the snort package.

3. Snort.org changed there md5 checksum format, result broke the pfsense snort packge.

4. I fixed the snort package.

5. Snort.org changed there urls, result broke the pfsense snort packge.

6. I fixed the snort package.

7. Snort.org changed there new oink code verification system , result broke the pfsense snort packge.

8. I fixed the snort package. All is good so far.

Thanx
James

P.S. 1clicc

Its normal.
Snort is just telling you you need to adjust your rules for your system. Read the snort manual for more help.